GPS and worker monitoring in Belgium: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior information and consultation of the works council (conseil d'entreprise) (CCT/CAO no. 81, art. 7)

  It dependsonly in certain cases

  Before installing a monitoring system the employer must inform the works council (conseil d'entreprise); in its absence the cascade goes to the prevention committee, then to the union delegation, then to the workers. The works council exists from 50 employees.

  CCT n. 81 del 26 aprile 2002 (controllo delle comunicazioni elettroniche in rete)

• Prior authorisation from an authority before installing

  Nonot required

  No prior authorisation from the APD/GBA is required; the accountability principle applies, with an impact assessment when the risk is high and consultation of the authority only if a high residual risk remains.

  APD/GBA, valutazione d'impatto sulla protezione dei dati

• Prior information to workers (legal basis, rights; art. 13 GDPR)

  Yesrequired

  The employer must communicate beforehand the legal basis of the processing, the purposes and the workers' rights; the basis is not usually consent but legitimate interest or contractual/legal necessity.

  APD/GBA, geolocalizzazione dei lavoratori

• Ban on permanent and systematic monitoring (disproportionate); deactivatable outside working hours

  Yesrequired

  According to the APD, permanent monitoring with systematic reading of location data is in principle disproportionate; the system must be able to be deactivated when the vehicle is used outside working hours.

  APD/GBA, geolocalizzazione dei lavoratori

• Impact assessment (DPIA) for large-scale systematic monitoring

  Yesrequired

  An impact assessment is required when the processing is likely to result in a high risk, such as large-scale systematic monitoring.

  APD/GBA, valutazione d'impatto sulla protezione dei dati

The procedure, step by step

1. 1

   Inform and consult the works council (conseil d'entreprise) before installing (CCT/CAO no. 81); in its absence, follow the cascade: prevention committee, union delegation, workers.

2. 2

   Identify a valid legal basis (legitimate interest or contractual/legal necessity), not consent.

3. 3

   Inform the workers beforehand about the legal basis, the purposes and their rights.

4. 4

   Carry out the impact assessment for large-scale systematic monitoring.

5. 5

   Configure the system: no permanent monitoring, deactivation outside working hours.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• CCT n. 81 del 26 aprile 2002 (controllo delle comunicazioni elettroniche in rete)
• APD/GBA, geolocalizzazione dei lavoratori
• APD/GBA, valutazione d'impatto sulla protezione dei dati
• APD/GBA, presentare un reclamo
• Chambre Contentieuse APD/GBA, decisione 114/2024 (impronte per le presenze, 45.000 euro)
• Regolamento UE 2016/679 (GDPR)